Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-85617

snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allows restricted users to soft-delete users outside their authorized scope. Attackers can include unauthorized user IDs in bulk delete requests to bypass instance-level restrictions and modify or disable accounts they should not access.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 18.0%
CVSS Severity
CVSS v3 Score 8.8
Products affected by CVE-2026-85617


Contact Us

Shodan ® - All rights reserved